Bluenoroff is Kaspersky's name for a financially motivated unit within the broader Lazarus formation. Kaspersky introduced the designation publicly in 2017 while documenting bank intrusions connected to the 2016 Bangladesh Central Bank theft and other attacks on financial institutions and SWIFT-connected systems. The group used watering holes, backdoors, compromised infrastructure, and malware tailored to banking environments, with activity spanning multiple countries. By 2022, Kaspersky described a shift from banks and SWIFT servers toward cryptocurrency businesses as the group's principal source of illicit income. Operators created convincing cryptocurrency software companies and applications, delivered backdoored updates, and used malicious documents and social engineering to abuse trust. The reporting portrays Bluenoroff as able to draw on the larger formation's malware, exploits, and infrastructure while maintaining a distinct financial objective.
Bithumb#2
#Bithumb2 • 2017-06
🇰🇷 Korea, Republic of
Bithumb disclosed that a 2017 hacking incident involving an employee personal PC exposed customer personal information, with later company reporting describing about 30,000 affected users and exposed names, email addresses, and phone numbers while stating that account IDs and passwords were not leaked. Bithumb said it reported the incident to Korean authorities, restricted affected accounts, operated a response center, compensated affected users, and distinguished the data exposure from later cryptocurrency losses tied to long-running credential-stuffing attempts and voice-phishing of authentication messages.
-
7
Related Reports
-
1
Affected Countries
-
110
Months Since
Related Actors
First seen: 2017-04 •
Last seen: 2026-07
Related Reports
2021-03-23
Carnegie Endowment
2019-08-31
UN